Sign in with a passkey

A passkey lets you sign in to your Sternway account without typing your email, and stands in for the authenticator code of two-factor authentication. It lives in Windows Hello, your phone, a security key or a password manager, and its private key never leaves it.

What a passkey cannot do

Your data is encrypted with keys that only your password unlocks. A passkey proves to the server that it is you; it does not hold, and cannot recreate, the key to your vaults. So:

• Signing in with a passkey on a device always ends with typing your password once, to unlock your data there.
• After that the device keeps its keys, as at any sign-in, until you log out.
• A new device still needs your password or your recovery kit.

Before you start

Passkeys need a server reached over HTTPS: browsers allow passkeys only on https:// addresses (and on localhost). They are bound to the server’s domain, so the server’s administrator decides that domain once (Run the sync server).

Sternway runs each passkey step in your system browser, on a page your server serves, and the browser hands the result back to the app. The page says which account asked for it: if you did not start it just now, cancel.

Add a passkey

• Desktop: Settings › Account & Sync › Security and account › Passkeys.
• Android: Settings › Account & Sync › Manage account › Security and account › Passkeys.

1. Choose Add a passkey and give it a Passkey name, such as the device or password manager that holds it.
2. Confirm with your password, and your authenticator code if two-factor is on. (A passkey can replace that code, so adding one needs both, like deleting the account does.)
3. Your browser opens. Create the passkey there within 5 minutes. Sternway continues by itself.

When a passkey is added, the account’s email gets a message (if the server can send mail), and every other signed-in device shows “A passkey was added to your account”. If you did not add it: remove it, change your password, and revoke the devices you do not know.

Sign in with it

1. On a signed-out device, open Settings › Account & Sync and choose Sign in with a passkey (on Android, under Manage account).
2. Type the server address. Your browser opens; pick the passkey.
3. Back in Sternway, type your password to unlock your data.

Instead of the two-factor code: at Log in, when the authenticator code is asked for, choose Use a passkey instead.

Rename or remove a passkey

In the same Passkeys list. Removing asks for your password (and code) too. Removing it here does not delete it from the device or password manager that holds it: do that there as well.

Where passkeys work

	Windows	Linux	Android
Windows Hello	yes (Edge, Chrome, Firefox)
Another phone, by QR code	yes (Chrome, Edge)	yes (Chrome, with Bluetooth)	yes (Android’s passkey sheet)
A security key (USB or NFC)	yes	yes	yes
A password manager’s passkeys	if its browser extension offers them	the same	if it is set as a passkey provider in Android’s settings
This phone’s screen lock			through the phone’s passkey provider (Google Password Manager needs a Google account on the phone)

The iPhone app does not offer passkeys.

What was checked

The server was tested with a software authenticator, and the desktop app end to end with a headless Chromium and its virtual authenticator. The Android app was run on an emulator up to Android’s own passkey sheet and back. No real Windows Hello, phone screen lock, password manager or security key has been used with Sternway’s passkeys yet.

Teams

A team that requires single sign-on refuses passkey sign-in for its members; they sign in with SSO. A team’s “Require two-factor” rule still means an authenticator app. Team owners see account.passkey.added, account.passkey.removed and account.passkey.used for their members in the audit log.